One prompt threatens AWS agents

The story: one prompt, one agent, too much cloud reach

The working headline is simple because the risk is simple: one prompt threatens AWS agents. Zenity Labs disclosed AgentCorruption on October 8, 2026, describing a chain of Amazon Bedrock AgentCore weaknesses in which researchers used a prompt sent to a public-facing agent to obtain cloud workload credentials and then reach other AgentCore agents within the same AWS account and region [1].

The finding matters because the attacker in the scenario did not need to exploit a classic web bug in the chat interface. The researchers’ starting point was an agent equipped with a common capability: a tool that can make outbound requests. By asking that agent to contact the AWS Instance Metadata Service, the agent made the request from inside its runtime environment and received temporary credentials tied to its execution role [1].

That turns a natural-language input into a server-side request forgery-style path. In a normal chatbot, a malicious instruction might produce a bad answer. In an agentic cloud system, the same class of instruction can cause a tool call, a network request, a credential retrieval and a chain of authorized API actions. Cyber Security News described the case as a prompt-driven path where the exposed agent only had to follow the user’s request and use an allowed web or shell tool [6].

Why AgentCore made the blast radius larger

AgentCorruption is not only about the first credential. The larger issue is what that credential was allowed to do. According to Zenity’s disclosure, the default execution role was not limited to the one compromised agent; it extended across AgentCore resources in the same AWS account and region [1].

That distinction is crucial. If a credential can act only on one agent, compromise is bad but contained. If it can enumerate, invoke and read across many agents, one public entry point becomes a bridge into private assistants, internal workflows, long-term memory and connected tools. Zenity said the researchers could access private conversations, source code, long-term memories, API keys, OAuth tokens and secrets stored in AWS Secrets Manager [1].

The Next Web also reported the same narrow scope after correcting its wording: the research concerned agents in a single AWS account and region, not every AWS agent everywhere [2]. That correction is important for defenders. The story is not that the whole AWS platform fell to one sentence; it is that one exposed agent, combined with broad same-account-and-region permissions, could collapse boundaries that teams may have assumed were separate [2].

The technical chain in plain language

The first stage was metadata access. The agent had a tool capable of making an HTTP request, and the prompt directed it to the local metadata service. That service provides temporary credentials to cloud workloads, so the agent returned identity material that could be used outside the conversation [1].

The second stage was permission expansion. With the execution role’s credentials, the researchers could reach other AgentCore resources in the same account and region. Reporting from Cyber Security News says Zenity used permissions such as DescribeLogGroups to find agent IDs, pulled container images from Amazon ECR, invoked internal agents and read session events [6].

The third stage was persistence and downstream credential exposure. Zenity said the chain allowed researchers to manipulate long-term memory, creating hidden instructions that could alter future agent behavior, and to retrieve credentials intended for connected services through AgentCore Identity and Secrets Manager paths [1]. ThreatCluster’s summary likewise identified memory manipulation and Secrets Manager access as part of the risk cluster around AgentCorruption [4].

This is why the case feels different from earlier prompt-injection headlines. The prompt was not merely persuasive text. It became the first move in an infrastructure sequence: prompt, tool call, metadata request, temporary credentials, cloud APIs, other agents, memories and secrets.

AWS’s position and the current state

The current state is more nuanced than “unfixed disaster.” Zenity’s public release says it responsibly disclosed the AgentCore findings to AWS on December 25, 2025, and that AWS later made IMDSv2 the default for AgentCore deployments [1]. Zenity also said its testing confirmed AWS had reduced the default execution role’s permissions, including removing permissions that allowed agents to invoke other agents, read private conversations or access secrets in AWS Secrets Manager [1].

AWS, however, disputes the framing. The Next Web reported an AWS statement saying the behavior was documented, not a vulnerability, and that an agent can access another AWS account only if permissions are explicitly granted on both the agent execution role and the target resource [2]. Cyber Security News similarly reported that AWS views access to an agent’s own execution-role credentials through the metadata service as expected and documented behavior [6].

Those two positions can both inform security practice. Zenity’s point is that defaults and agent tooling created a dangerous practical chain. AWS’s point is that workload credentials and IAM permissions remain the customer-controlled boundary. For security teams, the actionable conclusion is the same: do not let a public-facing agent run with permissions that would be catastrophic if the agent could be instructed to use them.

What defenders should check now

First, inventory every Amazon Bedrock AgentCore deployment and identify which agents are public-facing, which tools can make outbound network requests, and which IAM role each runtime uses. HackWatch classified the October 10 alert as a high-risk identity and account-compromise issue, while emphasizing that teams should verify whether the named product and configuration are actually present in their own environment before treating the headline as exposure [5].

Second, review execution roles for wildcards and regional breadth. A production agent should have access only to the specific runtime, memory, secret and downstream resource ARNs it needs. If one role can invoke all agents, list all sessions or read broad Secrets Manager values, the role is functioning as a lateral-movement bridge.

Third, treat agent memory as a security boundary. Agent memory is not just user convenience; it can become persistence. If a compromised role can write long-term memory, then the attacker’s instruction may survive beyond the initial chat and influence later sessions.

Fourth, constrain network egress. Any agent with web, shell or browser tools should be prevented from reaching metadata endpoints unless that access is deliberately required and safely mediated. Agentic systems should not be trusted to distinguish user intent from infrastructure boundaries.

The broader lesson

AgentCorruption shows why agent security cannot be reduced to prompt filtering. Filters may reduce obvious abuse, but the real control plane is identity, network access, tool authorization and secret scope.

The safest mental model is to stop calling these systems “chatbots.” A cloud agent is a workload with an identity, permissions, tools, memory and network routes. If it accepts untrusted language and can act on cloud resources, every prompt is potentially an API request in disguise.

The fix is therefore not one guardrail but a stack: prompt isolation, strict least privilege, per-agent credentials, scoped secrets, blocked metadata access where possible, separate accounts for public and internal agents, and monitoring that connects prompts to tool calls and cloud events. One prompt should never unlock cloud god mode.

Sources from the last 72 hours

1. [1]Zenity Labs Discloses AgentCorruption, a Chain of AWS AgentCore Flaws That Allowed One Prompt to Take Over All AgentCore Agents Within an AWS Account and RegionOct 8, 2026, 3:01 PM
2. [2]Zenity says one prompt took over every AgentCore agent in an AWS accountOct 8, 2026, 4:14 PM
3. [3]AgentCorruption tests expose cloud credentials through one AI agentOct 8, 2026, 9:00 PM
4. [4]Vulnerability in AWS Bedrock AgentCore Exposes AI Agents to HijackingOct 9, 2026, 4:34 PM
5. [5]AWS Bedrock AgentCore Flaw Allowed Attackers to Hijack AI Agents Using a Single PromptOct 10, 2026, 9:40 AM
6. [6]One Prompt Could Hijack AWS AI Agents and Steal Cloud CredentialsOct 10, 2026, 2:00 AM

AI-generated article based on recent web research, then preserved as a dated editorial snapshot.